@tulipes/cli 0.2.0-rc.2 → 0.3.0-rc.2

package/templates/app/modules/agent/controllers/{agent.controllers.ts → web.agent.controllers.ts}

@@ -3,12 +3,11 @@ import type { BackendCtx } from "@tulipes/core/boot";
 import { roleOf } from "@tulipes/core/http";
 
 /**
- * The HTTP transport over `ctx.agent`: the manifest a role may call, and
- * the action endpoint. Route tools are not invoked here — the manifest
- * gives their method and path, and an agent calls them like any client,
- * through the same middleware.
+ * The HTTP transport over `ctx.agent`, for agents outside the process:
+ * the manifest a role may call, and the action endpoint. An agent inside
+ * the app needs neither — it reads `ctx.agent` directly.
  */
-export class AgentController {
+export class WebAgentController {
   readonly #ctx: BackendCtx;
 
   constructor(ctx: BackendCtx) {

package/templates/app/modules/agent/routes/{agent.routes.ts → web.agent.routes.ts}

@@ -1,28 +1,26 @@
 import { Router } from "express";
 import type { BackendCtx } from "@tulipes/core/boot";
 
-import { AgentController } from "../controllers/agent.controllers.ts";
+import { WebAgentController } from "../controllers/web.agent.controllers.ts";
 import { toolInput, toolName } from "../schemas/agent.schemas.ts";
 
 export default function agentRoutes(ctx: BackendCtx): void {
   const { rai, routes, config } = ctx;
   const router = Router();
-  const agent = new AgentController(ctx);
+  const agent = new WebAgentController(ctx);
 
   router.get("/tools", rai({
-      id: "agent:tools",
+      id: "agent:web:tools",
       name: "List the tools an agent may call",
       description: "The manifest filtered to the caller's role: route tools with their method and path, actions with their input schema",
-      agent: false,
     }), agent.tools());
 
   router.post("/tools/:name", rai({
-      id: "agent:invoke",
+      id: "agent:web:invoke",
       name: "Run a declared action",
       description: "Runs an action from a module's agent declaration; the action's own permission and input schema apply",
       params: toolName,
       body: toolInput,
-      agent: false,
     }), agent.invoke());
 
   routes.mount(router, `${config.api!.prefix}/agent`);

package/templates/app/modules/auth/bootstrap/credentials.bootstrap.ts

@@ -5,22 +5,30 @@ import type { RuntimeCtx } from "@tulipes/core/boot";
  * the scaffold's placeholders, and the two keys must differ so leaking one
  * cannot mint the other. Sorted before seed-admin so the admin is never
  * seeded with a refused password.
+ *
+ * The values are this module's environment values, `config.auth.*`; the
+ * message names the variables an operator sets, not the config names.
  */
-export default function credentials({ Environment }: RuntimeCtx): void {
-  if (Environment.appEnv !== "production" && Environment.appEnv !== "staging") return;
+const PLACEHOLDERS = [
+  ["jwtAccessSecret", "JWT_ACCESS_SECRET", "dev-only-access-secret-change-me"],
+  ["jwtRefreshSecret", "JWT_REFRESH_SECRET", "dev-only-refresh-secret-change-me"],
+  ["adminPassword", "AUTH_ADMIN_PASSWORD", "dev-admin-password"],
+  ["adminEmail", "AUTH_ADMIN_EMAIL", "admin@example.com"],
+] as const;
+
+export default function credentials({ appEnv, config }: RuntimeCtx): void {
+  if (appEnv !== "production" && appEnv !== "staging") return;
+
+  const auth = config.auth!;
   const invalid: string[] = [];
-  const defaults = [
-    ["JWT_ACCESS_SECRET", "dev-only-access-secret-change-me"],
-    ["JWT_REFRESH_SECRET", "dev-only-refresh-secret-change-me"],
-    ["AUTH_ADMIN_PASSWORD", "dev-admin-password"],
-    ["AUTH_ADMIN_EMAIL", "admin@example.com"],
-  ] as const;
-  for (const [name, developmentValue] of defaults) {
-    const value = String(Environment.get(name)).trim();
-    if (!value || value === developmentValue) invalid.push(name);
+
+  for (const [name, variable, developmentValue] of PLACEHOLDERS) {
+    const value = auth[name].trim();
+    if (!value || value === developmentValue) invalid.push(variable);
   }
-  if (Environment.get("JWT_ACCESS_SECRET") === Environment.get("JWT_REFRESH_SECRET")) {
+  if (auth.jwtAccessSecret === auth.jwtRefreshSecret) {
     invalid.push("JWT_ACCESS_SECRET / JWT_REFRESH_SECRET (use distinct keys)");
   }
+
   if (invalid.length) throw new Error("Unsafe production credentials: configure " + invalid.join(", "));
 }

package/templates/app/modules/auth/bootstrap/seed-admin.bootstrap.ts

@@ -15,7 +15,9 @@ import type { UserDoc } from "../helpers/documents.ts";
 export default async function seedAdmin(ctx: DatabaseCtx): Promise<void> {
   // Bootstrap runs in every mode; a one-off script has no business seeding.
   if (ctx.mode === "script") return;
-  const email = String(ctx.Environment.get("AUTH_ADMIN_EMAIL")).toLowerCase();
+  // The seeded credentials are this module's environment values.
+  const { adminEmail, adminPassword } = ctx.config.auth!;
+  const email = adminEmail.toLowerCase();
   const User = ctx.models.get<UserDoc>("User");
 
   let user: Pick<UserDoc, "_id"> | null = await User.findOne({ email }).lean();
@@ -39,6 +41,6 @@ export default async function seedAdmin(ctx: DatabaseCtx): Promise<void> {
     .limit(1);
 
   if (existing === 0) {
-    await setPassword(ctx, String(user!._id), String(ctx.Environment.get("AUTH_ADMIN_PASSWORD")));
+    await setPassword(ctx, String(user!._id), adminPassword);
   }
 }

package/templates/app/modules/auth/controllers/{auth.controllers.ts → web.auth.controllers.ts}

@@ -42,7 +42,7 @@ interface Credentials {
  * "invalidCredentials" becomes INVALID_CREDENTIALS with a translated
  * message and there is no second string to keep in step.
  */
-export class AuthController {
+export class WebAuthController {
   readonly #ctx: Ctx;
 
   constructor(ctx: Ctx) {

package/templates/app/modules/auth/helpers/passport.ts

@@ -92,7 +92,7 @@ export function configurePassport(ctx: Ctx): void {
         // Cookies and URL parameters never authenticate this starter. A cookie
         // extractor would also need the policy described in docs/browser-auth.md.
         jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
-        secretOrKey: String(ctx.Environment.get("JWT_ACCESS_SECRET")),
+        secretOrKey: ctx.config.auth!.jwtAccessSecret,
         passReqToCallback: false,
       },
       async (claims: TokenClaims, done) => {

package/templates/app/modules/auth/helpers/session-cache.ts

@@ -32,18 +32,18 @@ export function cacheTtlSeconds(ctx: Ctx): number {
 
 export async function readIdentity(ctx: Ctx, sid: string): Promise<CachedIdentity | null> {
   if (cacheTtlSeconds(ctx) === 0) return null;
-  return appCache(ctx.Environment).get<CachedIdentity>(KEY + sid);
+  return appCache(ctx).get<CachedIdentity>(KEY + sid);
 }
 
 export async function writeIdentity(ctx: Ctx, sid: string, identity: CachedIdentity): Promise<void> {
   const ttl = cacheTtlSeconds(ctx);
   if (ttl === 0) return;
-  await appCache(ctx.Environment).set(KEY + sid, identity, ttl);
+  await appCache(ctx).set(KEY + sid, identity, ttl);
 }
 
 /** Forget one session: the next request with its token takes the cold path. */
 export async function forgetSession(ctx: Ctx, sid: string): Promise<void> {
-  await appCache(ctx.Environment).del(KEY + sid);
+  await appCache(ctx).del(KEY + sid);
 }
 
 /**

package/templates/app/modules/auth/helpers/tokens.ts

@@ -36,12 +36,10 @@ export interface SessionOrigin {
   user_agent?: string;
 }
 
+// The signing keys are this module's environment values, read where they
+// are used: inspection has no value, and nothing here runs under it.
 const secret = (ctx: Ctx, typ: "access" | "refresh"): string =>
-  String(
-    ctx.Environment.get(
-      typ === "access" ? "JWT_ACCESS_SECRET" : "JWT_REFRESH_SECRET",
-    ),
-  );
+  typ === "access" ? ctx.config.auth!.jwtAccessSecret : ctx.config.auth!.jwtRefreshSecret;
 
 // Read at signing time, never cached: token policy is a setting an operator
 // changes without a restart.

package/templates/app/modules/auth/module.acl.ts

@@ -1,31 +1,53 @@
 import type { AclBuilder } from "@tulipes/core/acl";
 
+/**
+ * Roles carry whatever the app wants to read back about them. Declaring an
+ * extra here types it everywhere: `ctx.acl.role("admin")?.level` is a
+ * number. Anything undeclared is still accepted, just untyped.
+ */
+declare module "@tulipes/core/acl" {
+  interface RoleMeta {
+    /** Higher reaches more. For display and ordering; the ACL decides access. */
+    level?: number;
+  }
+}
+
 /**
  * The auth module owns the role vocabulary, because roles only mean
- * anything alongside the thing that assigns them.
+ * anything alongside the thing that assigns them. `pnpm tulipes roles`
+ * prints them with their descriptions and every grant they hold.
  *
  * `guest` is the fallback for a request with no valid token. That is what
  * makes "public endpoint" an ordinary ACL grant rather than a second
  * mechanism: login is public because guest may do it, not because a path
  * appears on an allowlist somewhere else.
+ *
+ * Every permission is a RAI id, `module:scope:resource[:extra]`. This app
+ * has two scopes: `web`, what a signed-in client calls, and `bo`, the back
+ * office. A grant names one id or a prefix: `users:bo:*` is the whole users
+ * back office, `users:*` every users surface, `*` everything.
  */
 export default function authAcl(acl: AclBuilder): void {
-  acl.defineRole("guest").defineRole("user").defineRole("admin").defineRole("sysadmin");
+  acl
+    .defineRole("guest", { description: "Any request without a valid token", level: 0 })
+    .defineRole("user", { description: "A signed-in account", level: 1 })
+    .defineRole("admin", { description: "Runs the back office", level: 2 })
+    .defineRole("sysadmin", { description: "Administers the deployment and its settings", level: 3 });
 
   // Anyone may attempt to authenticate. Refresh is public because the
   // refresh token itself is the credential — an expired access token must
   // not stand in the way of renewing it.
-  acl.allow("guest", "auth:login", "auth:register", "auth:refresh");
+  acl.allow("guest", "auth:web:login", "auth:web:register", "auth:web:refresh");
 
   // Signed in: end your session, read yourself, change your own password,
-  // and manage the devices you are signed in on.
+  // and manage the devices you are signed in on (`auth:web:sessions:*`
+  // covers listing them and ending one).
   acl.allow(
     "user",
-    "auth:logout",
-    "auth:me",
-    "auth:password",
-    "auth:sessions",
-    "auth:session-end",
+    "auth:web:logout",
+    "auth:web:me",
+    "auth:web:password",
+    "auth:web:sessions:*",
   );
   // `admin` is granted each feature namespace EXPLICITLY rather than "*".
   // A wildcard would also reach settings:*, and the infrastructure console

package/templates/app/modules/auth/module.config.ts

@@ -3,9 +3,11 @@ import { z } from "zod/v4";
 
 /**
  * Token policy is a setting: every deployment wants to tune it, none of it
- * is secret. The signing keys and the seeded admin credentials stay in the
- * environment, where secrets belong, and `bootstrap/credentials.bootstrap.ts`
- * refuses development values outside development.
+ * is secret. The signing keys and the seeded admin credentials are this
+ * module's environment values (package.json `tulipes.env`), where secrets
+ * belong — read as `config.auth.jwtAccessSecret` and the like, never listed
+ * — and `bootstrap/credentials.bootstrap.ts` refuses development values
+ * outside development.
  */
 export default defineConfig({
   schema: z.object({

package/templates/app/modules/auth/package.json

@@ -9,36 +9,36 @@
   "tulipes": {
     "tier": "sys",
     "priority": 20,
-    "env": [
-      {
-        "name": "JWT_ACCESS_SECRET",
+    "env": {
+      "jwtAccessSecret": {
+        "key": "JWT_ACCESS_SECRET",
         "type": "secret",
         "group": "auth",
         "required": true,
         "description": "Signing key for short-lived access tokens"
       },
-      {
-        "name": "JWT_REFRESH_SECRET",
+      "jwtRefreshSecret": {
+        "key": "JWT_REFRESH_SECRET",
         "type": "secret",
         "group": "auth",
         "required": true,
         "description": "Signing key for refresh tokens; separate from the access key so leaking one cannot mint the other"
       },
-      {
-        "name": "AUTH_ADMIN_EMAIL",
+      "adminEmail": {
+        "key": "AUTH_ADMIN_EMAIL",
         "type": "string",
         "group": "auth",
         "required": true,
         "description": "Email of the admin account seeded on first boot"
       },
-      {
-        "name": "AUTH_ADMIN_PASSWORD",
+      "adminPassword": {
+        "key": "AUTH_ADMIN_PASSWORD",
         "type": "secret",
         "group": "auth",
         "required": true,
         "description": "Password for the seeded admin account; change it after the first login"
       }
-    ]
+    }
   },
   "dependencies": {
     "@app/core": "workspace:*",

package/templates/app/modules/auth/routes/{auth.routes.ts → web.auth.routes.ts}

@@ -3,7 +3,7 @@ import passport from "passport";
 import type { BackendCtx } from "@tulipes/core/boot";
 import { lazy } from "@app/core";
 
-import { AuthController } from "../controllers/auth.controllers.ts";
+import { WebAuthController } from "../controllers/web.auth.controllers.ts";
 import { authenticate, configurePassport } from "../helpers/passport.ts";
 import {
   credentials,
@@ -14,9 +14,14 @@ import {
   tokenPair,
 } from "../schemas/auth.schemas.ts";
 
+/**
+ * Every endpoint here serves the client-facing surface, so the file is
+ * named scope-first (`web.auth.routes.ts`) and every id is `auth:web:…`.
+ * A back-office surface would sit beside it as `bo.auth.routes.ts`.
+ */
 export default function authRoutes(ctx: BackendCtx): void {
   const { app, rai, routes, config } = ctx;
-  const auth = new AuthController(ctx);
+  const auth = new WebAuthController(ctx);
 
   // Passport reads the signing keys when it is configured, so it is
   // configured on the first request, after which every request is identified
@@ -30,7 +35,7 @@ export default function authRoutes(ctx: BackendCtx): void {
   const router = Router();
 
   router.post("/register", rai({
-      id: "auth:register",
+      id: "auth:web:register",
       status: 201,
       name: "Register",
       description: "Create an account and its credential",
@@ -38,7 +43,7 @@ export default function authRoutes(ctx: BackendCtx): void {
     }), auth.register());
 
   router.post("/login", rai({
-      id: "auth:login",
+      id: "auth:web:login",
       name: "Log in",
       description: "Exchange email and password for a token pair",
       body: credentials,
@@ -46,7 +51,7 @@ export default function authRoutes(ctx: BackendCtx): void {
     }), auth.login());
 
   router.post("/refresh", rai({
-      id: "auth:refresh",
+      id: "auth:web:refresh",
       name: "Refresh tokens",
       description: "Rotate a refresh token for a new pair",
       body: refreshBody,
@@ -54,19 +59,19 @@ export default function authRoutes(ctx: BackendCtx): void {
     }), auth.refresh());
 
   router.post("/logout", rai({
-      id: "auth:logout",
+      id: "auth:web:logout",
       name: "Log out",
       description: "Revoke this session immediately",
     }), auth.logout());
 
   router.get("/me", rai({
-      id: "auth:me",
+      id: "auth:web:me",
       name: "Who am I",
       description: "The caller and the session behind this request",
     }), auth.me());
 
   router.get("/sessions", rai({
-      id: "auth:sessions",
+      id: "auth:web:sessions",
       name: "List sessions",
       description: "Every device this account is signed in on",
       // These two are auth's, but they answer a different question from
@@ -76,7 +81,7 @@ export default function authRoutes(ctx: BackendCtx): void {
     }), auth.sessions());
 
   router.delete("/sessions/:sid", rai({
-      id: "auth:session-end",
+      id: "auth:web:sessions:end",
       name: "End a session",
       description: "Sign one other device out",
       folder: "sessions",
@@ -84,7 +89,7 @@ export default function authRoutes(ctx: BackendCtx): void {
     }), auth.revokeSession());
 
   router.post("/password", rai({
-      id: "auth:password",
+      id: "auth:web:password",
       name: "Change password",
       description: "Set a new password and end every other session",
       body: newPassword,

package/templates/app/modules/auth/tests/auth.test.ts

@@ -255,7 +255,7 @@ test("invalid refresh credentials cannot revoke a live family", async () => {
   const initial = await account();
   const other = await account();
   const original = jwt.decode(initial.refresh_token) as Record<string, unknown>;
-  const key = String(app.handle.ctx.Environment.get("JWT_REFRESH_SECRET"));
+  const key = String(app.handle.ctx.config.auth!.jwtRefreshSecret);
 
   const sign = (changes: Record<string, unknown>) =>
     jwt.sign({ ...original, ...changes }, key);

package/templates/app/modules/config/controllers/{config.controllers.ts → bo.config.controllers.ts}

@@ -4,7 +4,7 @@ import { SettingsConflictError, SettingsValidationError } from "@tulipes/core/co
 import { HttpError, ValidationError } from "@tulipes/core/http";
 
 import { auditChange } from "../helpers/audit.ts";
-import { describeModule } from "../helpers/describe.ts";
+import { describeModule, describeRoles } from "../helpers/describe.ts";
 
 /**
  * The console: what every module is configured with, and the one write —
@@ -14,7 +14,7 @@ import { describeModule } from "../helpers/describe.ts";
  * the environment: a variable is what boot needs before the store answers
  * or a secret, and neither is edited at runtime.
  */
-export class ConfigController {
+export class BoConfigController {
   readonly #ctx: Ctx;
 
   constructor(ctx: Ctx) {
@@ -28,6 +28,7 @@ export class ConfigController {
         data: {
           app: this.#ctx.config.app ?? {},
           store: this.#ctx.settings.status(),
+          roles: describeRoles(this.#ctx),
           modules: this.#ctx.modules.map((module) => describeModule(this.#ctx, module.name)),
         },
       });

package/templates/app/modules/config/helpers/audit.ts

@@ -27,7 +27,7 @@ export async function auditChange(
       actor: String(user._id),
       actor_role: user.role,
       ip: req.ip,
-      app_env: ctx.Environment.appEnv,
+      app_env: ctx.appEnv,
       mode: ctx.mode,
       recorded_at: new Date(),
     }).save({ w: "majority", j: true, wtimeout: 5000 });

package/templates/app/modules/config/helpers/describe.ts

@@ -2,8 +2,9 @@ import type { Ctx } from "@tulipes/core/boot";
 
 /**
  * Everything the framework knows about one module, for the console: the
- * manifest, the variables it declares (names, types, sources — a secret's
- * value never, any value only as what the process resolved), its settings
+ * manifest, the environment values it declares (config names, variables,
+ * types, sources — a secret's value never, any value only as what the
+ * process resolved), its settings
  * with their schema, live values and stored version, and its endpoints
  * with the roles that reach them. Nothing is invented: it all comes from
  * the booted context, so the console cannot describe an app different
@@ -13,25 +14,24 @@ export function describeModule(ctx: Ctx, name: string): Record<string, unknown>
   const manifest = ctx.modules.find((entry) => entry.name === name);
   if (!manifest) return undefined;
 
-  const variables = ctx.Environment.store.describe()
-    .filter((variable) => variable.owner === name)
-    .map((variable) => ({
-      name: variable.spec.name,
-      type: variable.spec.type,
-      description: variable.spec.description,
-      group: variable.spec.group ?? null,
-      required: variable.spec.required ?? false,
-      enum: variable.spec.enum ?? null,
-      default: variable.spec.type === "secret" ? null : (variable.spec.default ?? null),
-      source: variable.source,
-      is_secret: variable.isSecret,
-      is_set: variable.isSet,
-      // What this process resolved; a secret is never here.
-      value: variable.isSecret ? null : (variable.value ?? null),
-    }));
+  // The env half of the module's namespace, as the framework describes it:
+  // a secret's value and default are already withheld.
+  const variables = ctx.settings.describeEnv(name).map((variable) => ({
+    name: variable.name,
+    key: variable.key,
+    type: variable.type,
+    description: variable.description,
+    group: variable.group ?? null,
+    required: variable.required,
+    enum: variable.enum ?? null,
+    default: variable.default ?? null,
+    source: variable.source ?? null,
+    is_secret: variable.isSecret,
+    is_set: variable.isSet,
+    value: variable.value ?? null,
+  }));
 
   const settings = ctx.settings.namespaces().includes(name) ? ctx.settings.describe(name) : undefined;
-  const grants = ctx.acl?.describe() ?? [];
   const routes = ctx.routes.all()
     .filter((record) => record.module === name)
     .map((record) => ({
@@ -39,7 +39,8 @@ export function describeModule(ctx: Ctx, name: string): Record<string, unknown>
       method: record.method.toUpperCase(),
       path: record.path,
       name: record.info.name ?? null,
-      roles: ctx.routes.checker ? "dynamic" : rolesFor(grants, record.info.id),
+      // The ACL resolves who holds the id exactly as it gates the request.
+      roles: ctx.routes.checker ? "dynamic" : (ctx.acl?.rolesFor(record.info.id) ?? []),
     }));
 
   return {
@@ -63,10 +64,18 @@ export function describeModule(ctx: Ctx, name: string): Record<string, unknown>
   };
 }
 
-function rolesFor(grants: { role: string; resource: string }[], id: string): string[] {
-  const namespace = `${id.split(":")[0]}:*`;
-  const roles = grants
-    .filter(({ resource }) => resource === id || resource === "*" || resource === namespace)
-    .map(({ role }) => role);
-  return [...new Set(roles)].sort();
+/**
+ * Every role the app defines, with the description and extras it was
+ * defined with — so the console can say who "admin" is, not just that it
+ * exists — and the grants each one holds.
+ */
+export function describeRoles(ctx: Ctx): Record<string, unknown>[] {
+  const grants = ctx.acl?.describe() ?? [];
+  return (ctx.acl?.describeRoles() ?? []).map(({ name, definedBy, description, ...extras }) => ({
+    name,
+    description: description ?? null,
+    defined_by: definedBy,
+    extras,
+    grants: grants.filter(({ role }) => role === name).map(({ resource }) => resource).sort(),
+  }));
 }

package/templates/app/modules/config/module.acl.ts

@@ -7,6 +7,6 @@ import type { AclBuilder } from "@tulipes/core/acl";
  * grants `admin` the `*` wildcard.
  */
 export default function configAcl(acl: AclBuilder): void {
-  acl.allow("admin", "config:read", "config:describe");
+  acl.allow("admin", "config:bo:read", "config:bo:describe");
   acl.allow("sysadmin", "config:*");
 }

package/templates/app/modules/config/routes/{config.routes.ts → bo.config.routes.ts}

@@ -1,23 +1,23 @@
 import { Router } from "express";
 import type { BackendCtx } from "@tulipes/core/boot";
 
-import { ConfigController } from "../controllers/config.controllers.ts";
+import { BoConfigController } from "../controllers/bo.config.controllers.ts";
 import { changeBody, moduleParam } from "../schemas/config.schemas.ts";
 
 export default function configRoutes(ctx: BackendCtx): void {
   const { rai, routes, config } = ctx;
   const router = Router();
-  const console = new ConfigController(ctx);
+  const console = new BoConfigController(ctx);
 
   router.get("/", rai({
-      id: "config:read",
+      id: "config:bo:read",
       name: "Describe the app",
       description: "Every module in load order: manifest, declared variables (names, types, sources; secrets never), settings with schema, live values and stored version, endpoints with the roles that reach them",
       folder: "config",
     }), console.app());
 
   router.get("/:module", rai({
-      id: "config:describe",
+      id: "config:bo:describe",
       name: "Describe one module",
       description: "The same description for one module",
       folder: "config",
@@ -25,7 +25,7 @@ export default function configRoutes(ctx: BackendCtx): void {
     }), console.module());
 
   router.patch("/:module", rai({
-      id: "config:write",
+      id: "config:bo:write",
       name: "Change a module's settings",
       description: "A patch over the stored values, validated by the module's schema; a stale version is refused; applied at once in every replica, except fields tagged restart, which apply on the next boot",
       folder: "config",

package/templates/app/modules/config/tests/config.test.ts

@@ -8,7 +8,8 @@ import { useTestApp } from "@tulipes/testing";
 import { testEnv, testSettings } from "../../../tests/support.ts";
 
 const rootDir = fileURLToPath(new URL("../../../", import.meta.url));
-const app = useTestApp({ rootDir, env: testEnv(), settings: testSettings() }, { beforeAll, afterAll });
+const env = testEnv();
+const app = useTestApp({ rootDir, env, settings: testSettings() }, { beforeAll, afterAll });
 
 
 const tokens = z.object({
@@ -79,16 +80,23 @@ test("the console describes every module without a secret's value and only admin
 
   const response = await get("/api/v1/config", admin.access_token);
   expect(response.status).toBe(200);
-  const { data } = (await response.json()) as { data: { store: { ready: boolean }; modules: Record<string, unknown>[] } };
+  const { data } = (await response.json()) as { data: { store: { ready: boolean }; roles: Record<string, unknown>[]; modules: Record<string, unknown>[] } };
   expect(data.store.ready).toBe(true);
   expect(data.modules.map((module) => module.name)).toEqual(app.handle.ctx.modules.map((module) => module.name));
+  expect(data.roles).toContainEqual({
+    name: "admin",
+    description: "Runs the back office",
+    defined_by: "auth",
+    extras: { level: 2 },
+    grants: ["agent:*", "auth:*", "config:bo:describe", "config:bo:read", "hello:*", "users:*"],
+  });
 
   const auth = data.modules.find((module) => module.name === "auth") as { variables: Record<string, unknown>[]; settings: { values: Record<string, unknown>; version: number }; routes: Record<string, unknown>[] };
-  const secret = auth.variables.find((variable) => variable.name === "JWT_ACCESS_SECRET")!;
-  expect(secret).toMatchObject({ is_secret: true, is_set: true, value: null, default: null });
-  expect(JSON.stringify(data)).not.toContain(process.env.JWT_ACCESS_SECRET);
+  const secret = auth.variables.find((variable) => variable.name === "jwtAccessSecret")!;
+  expect(secret).toMatchObject({ key: "JWT_ACCESS_SECRET", type: "secret", source: "process.env", is_secret: true, is_set: true, value: null, default: null });
+  expect(JSON.stringify(data)).not.toContain(env.JWT_ACCESS_SECRET);
   expect(auth.settings.values).toMatchObject({ accessTtl: "15m" });
-  expect(auth.routes).toContainEqual(expect.objectContaining({ id: "auth:login", method: "POST", roles: expect.arrayContaining(["guest"]) }));
+  expect(auth.routes).toContainEqual(expect.objectContaining({ id: "auth:web:login", method: "POST", roles: expect.arrayContaining(["guest"]) }));
 
   // The administrator may read; writing is the deployment's job.
   expect((await patch("/api/v1/config/hello", { values: { greeting: "Nope" } }, admin.access_token)).status).toBe(403);